Spinnaker vulnerable to RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2026-32604. PoCs published by ZeroPathAI.
AI-analyzed exploit summary This repository contains functional exploit code for CVE-2026-32604, demonstrating a Git clone shell injection vulnerability in Spinnaker's Clouddriver service. The PoC leverages unsanitized branch names in artifact fetch requests to achieve remote code execution.
Description
Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable the gitrepo artifact types.
Exploits (1)
This repository contains functional exploit code for CVE-2026-32604, demonstrating a Git clone shell injection vulnerability in Spinnaker's Clouddriver service. The PoC leverages unsanitized branch names in artifact fetch requests to achieve remote code execution.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H